fkie_nvd - fkie_cve-2022-49672

FKIE_CVE-2022-49672

Vulnerability from fkie_nvd - Published: 2025-02-26 07:01 - Updated: 2025-10-24 15:52

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: net: tun: unlink NAPI from device on destruction Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3b9bc84d311104906d2b4995a9a02d7b7ddab2db	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8145f77d38de4f88b8a69e1463f5c09ba189d77c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/82e729aee59acefe135fceffadcbc5b86dd4f1b9	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8661d4b8faa2f7ee7a559969c0a7c57f077b1728	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a8cf919022373c97a84fe596bbea544f909c485d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bec1be0a745ab420718217e3e0d9542a75108989	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	5.19
linux	linux_kernel	5.19
linux	linux_kernel	5.19
linux	linux_kernel	5.19

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "83E1438F-F12B-4581-9EF4-B104DAEFFD41",
              "versionEndExcluding": "4.19.251",
              "versionStartIncluding": "4.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73056417-5BD5-453F-8EEC-2D5C48185372",
              "versionEndExcluding": "5.4.204",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAAE3E52-3C60-40CA-A245-AE5660F45CD8",
              "versionEndExcluding": "5.10.129",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "70DCF327-F4B6-4CDB-8C9E-98E909E60127",
              "versionEndExcluding": "5.15.53",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8261A22B-B156-4045-AE8E-AA9E95E7930C",
              "versionEndExcluding": "5.18.10",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "BF8547FC-C849-4F1B-804B-A93AE2F04A92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "F3068028-F453-4A1C-B80F-3F5609ACEF60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "2E9C0DB0-D349-489F-A3D6-B77214E93A8A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: unlink NAPI from device on destruction\n\nSyzbot found a race between tun file and device destruction.\nNAPIs live in struct tun_file which can get destroyed before\nthe netdev so we have to del them explicitly. The current\ncode is missing deleting the NAPI if the queue was detached\nfirst."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: tun: unlink NAPI from device on destruction Syzbot encontr\u00f3 una ejecuci\u00f3n entre el archivo tun y la destrucci\u00f3n del dispositivo. Las NAPI se encuentran en struct tun_file, que puede destruirse antes que netdev, por lo que debemos eliminarlas expl\u00edcitamente. Falta el c\u00f3digo actual que elimina la NAPI si la cola se separ\u00f3 primero."
    }
  ],
  "id": "CVE-2022-49672",
  "lastModified": "2025-10-24T15:52:07.587",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-02-26T07:01:42.130",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3b9bc84d311104906d2b4995a9a02d7b7ddab2db"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8145f77d38de4f88b8a69e1463f5c09ba189d77c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/82e729aee59acefe135fceffadcbc5b86dd4f1b9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8661d4b8faa2f7ee7a559969c0a7c57f077b1728"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/a8cf919022373c97a84fe596bbea544f909c485d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bec1be0a745ab420718217e3e0d9542a75108989"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2022-49672 (GCVE-0-2022-49672)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:24 – Updated: 2025-05-04 08:43

Summary

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/82e729aee59acefe1…
	https://git.kernel.org/stable/c/a8cf919022373c97a…
	https://git.kernel.org/stable/c/bec1be0a745ab4207…
	https://git.kernel.org/stable/c/8145f77d38de4f88b…
	https://git.kernel.org/stable/c/8661d4b8faa2f7ee7…
	https://git.kernel.org/stable/c/3b9bc84d311104906…

Impacted products

Vendor

Product

Version

Linux

Affected: 943170998b200190f99d3fe7e771437e2c51f319 , < 82e729aee59acefe135fceffadcbc5b86dd4f1b9 (git)
Affected: 943170998b200190f99d3fe7e771437e2c51f319 , < a8cf919022373c97a84fe596bbea544f909c485d (git)
Affected: 943170998b200190f99d3fe7e771437e2c51f319 , < bec1be0a745ab420718217e3e0d9542a75108989 (git)
Affected: 943170998b200190f99d3fe7e771437e2c51f319 , < 8145f77d38de4f88b8a69e1463f5c09ba189d77c (git)
Affected: 943170998b200190f99d3fe7e771437e2c51f319 , < 8661d4b8faa2f7ee7a559969c0a7c57f077b1728 (git)
Affected: 943170998b200190f99d3fe7e771437e2c51f319 , < 3b9bc84d311104906d2b4995a9a02d7b7ddab2db (git)

Linux

Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 4.19.251 , ≤ 4.19.* (semver)
Unaffected: 5.4.204 , ≤ 5.4.* (semver)
Unaffected: 5.10.129 , ≤ 5.10.* (semver)
Unaffected: 5.15.53 , ≤ 5.15.* (semver)
Unaffected: 5.18.10 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "82e729aee59acefe135fceffadcbc5b86dd4f1b9",
              "status": "affected",
              "version": "943170998b200190f99d3fe7e771437e2c51f319",
              "versionType": "git"
            },
            {
              "lessThan": "a8cf919022373c97a84fe596bbea544f909c485d",
              "status": "affected",
              "version": "943170998b200190f99d3fe7e771437e2c51f319",
              "versionType": "git"
            },
            {
              "lessThan": "bec1be0a745ab420718217e3e0d9542a75108989",
              "status": "affected",
              "version": "943170998b200190f99d3fe7e771437e2c51f319",
              "versionType": "git"
            },
            {
              "lessThan": "8145f77d38de4f88b8a69e1463f5c09ba189d77c",
              "status": "affected",
              "version": "943170998b200190f99d3fe7e771437e2c51f319",
              "versionType": "git"
            },
            {
              "lessThan": "8661d4b8faa2f7ee7a559969c0a7c57f077b1728",
              "status": "affected",
              "version": "943170998b200190f99d3fe7e771437e2c51f319",
              "versionType": "git"
            },
            {
              "lessThan": "3b9bc84d311104906d2b4995a9a02d7b7ddab2db",
              "status": "affected",
              "version": "943170998b200190f99d3fe7e771437e2c51f319",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.204",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.251",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.204",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.129",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.53",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.10",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: unlink NAPI from device on destruction\n\nSyzbot found a race between tun file and device destruction.\nNAPIs live in struct tun_file which can get destroyed before\nthe netdev so we have to del them explicitly. The current\ncode is missing deleting the NAPI if the queue was detached\nfirst."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:43:01.207Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/82e729aee59acefe135fceffadcbc5b86dd4f1b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8cf919022373c97a84fe596bbea544f909c485d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bec1be0a745ab420718217e3e0d9542a75108989"
        },
        {
          "url": "https://git.kernel.org/stable/c/8145f77d38de4f88b8a69e1463f5c09ba189d77c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8661d4b8faa2f7ee7a559969c0a7c57f077b1728"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b9bc84d311104906d2b4995a9a02d7b7ddab2db"
        }
      ],
      "title": "net: tun: unlink NAPI from device on destruction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49672",
    "datePublished": "2025-02-26T02:24:05.284Z",
    "dateReserved": "2025-02-26T02:21:30.437Z",
    "dateUpdated": "2025-05-04T08:43:01.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2022-49672

CVE-2022-49672 (GCVE-0-2022-49672)

Tags

Sightings

Nomenclature